Two critical security flaws in PHP, a programming language used by a large share of the internet, have triggered an urgent global cybersecurity response. The vulnerabilities could allow hackers to execute malicious code on vulnerable servers without authentication, potentially exposing sensitive information and disrupting online services.
The flaws, collectively referred to as PHP2Shell, have raised concerns among governments, technology companies and cybersecurity researchers. Several organisations have temporarily taken websites offline while assessing their exposure and applying security fixes. The incident has also highlighted how artificial intelligence is changing cybersecurity by helping researchers identify weaknesses that may have remained hidden for years.
PHP is estimated to power nearly 70% of websites whose server-side programming language can be identified. It is widely used in websites, content management systems and web applications, including platforms such as WordPress, Drupal, Joomla and Magento.
What are the PHP security flaws?
The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, affect PHP’s core runtime. Both received a critical severity rating of 9.2 out of 10 under the CVSS v4.0 system.
The weaknesses involve how PHP handles memory during certain request-processing operations. Under specific conditions, this can allow an attacker to exploit errors in the software and execute code remotely.
Remote code execution is particularly dangerous because it may allow an attacker to run commands on a compromised server. Depending on the system’s permissions and security controls, this could lead to data theft, website defacement, service disruption or further access to an organisation’s network.
Security researchers said the underlying flaws had existed for a long time. However, demonstrating how they could be exploited required a complex sequence of technical steps.
The PHP development team released security updates addressing the two vulnerabilities. The patched versions include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organisations running affected installations need to identify their versions and apply the appropriate fixes.
Older PHP versions that have reached end of life may not receive patches, making an upgrade to a supported release particularly important.
AI helps uncover hidden vulnerabilities
The incident has drawn attention to the growing role of artificial intelligence in cybersecurity research. Researchers at security firm Calif, working with OpenAI, reported one of the flaws after using AI-assisted analysis. Google-owned security company Wiz independently discovered another vulnerability using AI models.
AI tools can help researchers examine large amounts of code, identify unusual behaviour and explore complex combinations of conditions that might expose a weakness. Tasks that previously required extensive manual analysis can sometimes be completed more quickly with assistance from advanced models.
However, the same capabilities could also help malicious actors develop exploits and automate attacks. This creates a race between security teams working to find and fix vulnerabilities and attackers looking for systems that remain unprotected.
Reports from cybersecurity companies indicated that attempts to exploit the PHP weaknesses rose sharply after public disclosure. Cloudflare reported seeing millions of attempts, while Amazon Threat Intelligence described exploitation activity in the wild. These figures refer to attempted activity and do not establish that every attempt succeeded.
India among countries facing exposure
The potential impact is significant for Indian businesses and public services that depend on PHP-based websites, customer portals and online applications.
According to figures cited by cybersecurity firm CloudSEK, Shodan identified around 2.2 million internet-facing services worldwide displaying PHP information. India ranked ninth, with approximately 53,400 such services. The figures indicate visible services, not confirmed successful compromises.
Another assessment by Censys identified approximately 36.7 million internet-facing services reporting potentially affected PHP versions. These are service counts rather than unique servers or organisations, and some installations may already have been patched.
The findings nevertheless underline the challenge facing organisations that do not have dedicated cybersecurity teams. Even businesses that do not develop PHP applications themselves may be exposed through hosting providers, third-party software or embedded components.
What should organisations do?
Security specialists recommend identifying every PHP installation across websites, servers and applications, including systems managed by external vendors. Administrators should prioritise internet-facing services and install the appropriate security updates immediately.
Where an affected system cannot be patched promptly, temporarily disabling access or taking the service offline may be necessary to reduce risk. Organisations should also review server logs, monitor suspicious processes and investigate unexpected command-shell activity or unfamiliar file downloads.
Applying a patch does not automatically establish that a system has never been compromised. Businesses should investigate possible malicious activity and rotate credentials or security keys if there is evidence that they may have been exposed.
A separate PHP advisory issued on October 23 also urged users to temporarily disable the session upload progress feature under certain conditions until a further bug-fix release. Administrators should review the official advisory to determine whether their application configurations are affected.
A warning for the wider internet
The PHP vulnerabilities demonstrate how a weakness in widely used software can quickly become a global concern. Websites, online services and business systems often depend on layers of software that users rarely see, making timely security maintenance essential.
AI-assisted research may help defenders discover vulnerabilities sooner, but it also increases the importance of coordinated disclosure, reliable patching and continuous monitoring. For organisations in India and elsewhere, identifying exposed systems and applying fixes promptly remains the most effective immediate response.